)]}'
{"id":"openstack%2Fironic~987776","triplet_id":"openstack%2Fironic~stable%2F2025.1~Ie85357166fafca0acd9d852fe05ce34818d2b366","project":"openstack/ironic","branch":"stable/2025.1","topic":"security-bug-2148307-stable/2026.1-stable/2025.2-stable/2025.1","attention_set":{},"removed_from_attention_set":{"5890":{"account":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"last_update":"2026-05-08 14:55:34.000000000","reason":"\u003cGERRIT_ACCOUNT_5890\u003e replied on the change","reason_account":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"}},"10342":{"account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"last_update":"2026-05-08 16:09:17.000000000","reason":"Change was submitted"},"11655":{"account":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"last_update":"2026-05-08 16:09:17.000000000","reason":"Change was submitted"}},"hashtags":["ironic-week-prio"],"change_id":"Ie85357166fafca0acd9d852fe05ce34818d2b366","subject":"security: Use sandbox rendering for jinja2","status":"MERGED","created":"2026-05-07 23:48:47.000000000","updated":"2026-05-08 16:10:46.000000000","submitted":"2026-05-08 16:09:17.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"987776-security-bug-2148307-stable/2026.1-stable/2025.2-stable/2025.1","cherry_pick_of_change":987775,"cherry_pick_of_patch_set":2,"meta_rev_id":"fb12c94b9cf6343069be093918abdf508c1d0b29","_number":987776,"virtual_id_number":987776,"owner":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-05-08 16:09:17.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"all":[{"value":2,"date":"2026-05-08 14:55:34.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"all":[{"value":1,"date":"2026-05-08 14:55:34.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"all":[{"value":0,"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Do Not Backport"," 0":"Backport Review Needed","+1":"Should Backport"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-07 23:48:47.000000000","updated_by":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"reviewer":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"state":"CC"},{"updated":"2026-05-07 23:50:10.000000000","updated_by":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"reviewer":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"state":"REVIEWER"},{"updated":"2026-05-08 01:53:56.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"e5be0c5f8440b9f78e2bfd3fe4b1d8d5e86b4404","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-05-07 23:48:47.000000000","message":"Patch Set 1: Cherry Picked from branch stable/2025.2.","accounts_in_message":[],"_revision_number":1},{"id":"7192b0a6800e2f39dc553df6b8844815888f0f88","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-05-07 23:49:57.000000000","message":"Hashtag added: ironic-week-prio","accounts_in_message":[],"_revision_number":1},{"id":"ab43a41a41dbebfab28755806bd4b1a61740d1d1","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-05-07 23:50:10.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"1570159f83f9621ecae4294925e7561e2863783a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 01:53:56.000000000","message":"Patch Set 1: Verified-1\n\n(2 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/fb5f12c952d24eadb124404dcc9ec8e8\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/aa8cd196affc436585fa7ccb938c4f6e : SUCCESS in 9m 30s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/876a0f2f8fe44f0bb6a56da89e893a80 : FAILURE in 4m 39s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/e17b884927ec4dd3a4abd250616b5173 : SUCCESS in 7m 41s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/4f42f47cee3d496aa4cc1f643f4e749a : SUCCESS in 9m 31s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b58e15d072854b248c9afa24570994d4 : SUCCESS in 11m 09s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/8dcb223ac0de49edaceea8c9a7ab0b3f : SUCCESS in 15m 54s\n- ironic-tox-unit-mysql-migrations https://zuul.opendev.org/t/openstack/build/0b2b69b7fdf74fb6b48c18fdf58d2379 : SUCCESS in 6m 05s\n- ironic-tox-unit-with-driver-libs https://zuul.opendev.org/t/openstack/build/e1fa93d41ee14fdc9f2cd382f1e1a607 : SUCCESS in 6m 47s\n- ironic-cross-sushy https://zuul.opendev.org/t/openstack/build/74d5e8077a0c40b9a81bd443a07b755e : SUCCESS in 6m 53s (non-voting)\n- ironic-tempest-functional-python3 https://zuul.opendev.org/t/openstack/build/68b8661a68d8478f8893998467a9d551 : SUCCESS in 51m 45s\n- ironic-standalone-redfish https://zuul.opendev.org/t/openstack/build/59d9695c7cbd4457909da4110b543ca3 : SUCCESS in 1h 09m 45s (non-voting)\n- ironic-tempest-bios-redfish-pxe https://zuul.opendev.org/t/openstack/build/2786d3dd07684e7aac79818635151bb4 : SUCCESS in 43m 00s\n- ironic-tempest-uefi-redfish-vmedia https://zuul.opendev.org/t/openstack/build/71148dc5063b47f48d680a6ddf61a412 : SUCCESS in 42m 55s\n- ironic-tempest-ramdisk-bios-snmp-pxe https://zuul.opendev.org/t/openstack/build/98c51ff8549d416d91d5266fa2d52513 : SUCCESS in 36m 11s\n- ironic-tempest-uefi-redfish-https https://zuul.opendev.org/t/openstack/build/65aec9bfcc6f4d72bce95bc496a5b317 : SUCCESS in 22m 52s\n- ironic-tempest-ovn-uefi-ipmi-pxe https://zuul.opendev.org/t/openstack/build/cdc84d665b94411288420d059fc11187 : SUCCESS in 49m 20s\n- ironic-tempest-ovn-uefi-ipxe-ipv6 https://zuul.opendev.org/t/openstack/build/c1ec6ab02bc44c2585f2c4e8e43272d6 : SUCCESS in 1h 08m 45s\n- ironic-tempest-ipa-wholedisk-direct-tinyipa-multinode https://zuul.opendev.org/t/openstack/build/e695151424c14e909da9ac23df437258 : SUCCESS in 1h 44m 21s (non-voting)\n- ironic-tempest-ipa-wholedisk-direct-tinyipa-multinode-shard https://zuul.opendev.org/t/openstack/build/c651583f60154b6a95124c8beecc71da : SUCCESS in 1h 03m 12s (non-voting)\n- ironic-tempest-bios-ipmi-direct-tinyipa https://zuul.opendev.org/t/openstack/build/daf611fdbf464529a95eccdd816a5757 : SUCCESS in 1h 17m 35s\n- ironic-tempest-bfv https://zuul.opendev.org/t/openstack/build/b0d8b7b077e44ef19f39725387b4de9b : SUCCESS in 42m 28s\n- ironic-tempest-ipa-partition-uefi-pxe-grub2 https://zuul.opendev.org/t/openstack/build/b9a5143ac7204bdf87b87d3e4976a84b : SUCCESS in 44m 19s\n- ironic-tempest-uefi-redfish-vmedia-4k https://zuul.opendev.org/t/openstack/build/5e8d553a297149fea5be4c0700c2d218 : POST_FAILURE in 18m 17s\n- metalsmith-integration-glance-centos9-uefi https://zuul.opendev.org/t/openstack/build/6111156101a74d32afb9555ea1603cab : SUCCESS in 1h 41m 01s (non-voting)\n- ironic-grenade https://zuul.opendev.org/t/openstack/build/79877aaf7fd2417ab661b76c5c2a82d1 : SUCCESS in 39m 38s\n- ironic-grenade-skip-level https://zuul.opendev.org/t/openstack/build/19f69ba2d1c04868948788be922c23d2 : FAILURE in 52m 54s (non-voting)\n- ironic-inspector-tempest https://zuul.opendev.org/t/openstack/build/3527569d4dfe4f54bc3d67ebf74bf90c : SUCCESS in 47m 38s (non-voting)\n- ironic-inspector-tempest-uefi-redfish-vmedia https://zuul.opendev.org/t/openstack/build/fddac8c8a6bb4c8fb56d498b6ddb9471 : SUCCESS in 26m 15s (non-voting)\n- ironic-standalone-aarch64 https://zuul.opendev.org/t/openstack/build/98bc77bf419f4f2281b60536c3d234bd : FAILURE in 17m 53s (non-voting)\n- ironic-tempest-ipa-wholedisk-bios-ipmi-direct-dib https://zuul.opendev.org/t/openstack/build/7d93667622a242d29052d6394623910b : SUCCESS in 1h 20m 47s (non-voting)\n- ironic-standalone-anaconda https://zuul.opendev.org/t/openstack/build/fae6d33724cc4759980a6266bf0c7089 : SUCCESS in 51m 13s (non-voting)\n- bifrost-integration-tinyipa-ubuntu-noble https://zuul.opendev.org/t/openstack/build/fafe15131aa64104817699fbb9b7a4fc : SUCCESS in 42m 01s (non-voting)\n- bifrost-integration-redfish-vmedia-uefi-centos-9 https://zuul.opendev.org/t/openstack/build/dbde33bbb5cc4d7ebb83e1b5ae0018c6 : SUCCESS in 31m 18s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"09fd4919b24f02cea8b498c5bf131b89baa4ae6d","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"date":"2026-05-08 13:04:09.000000000","message":"Patch Set 2: Cherry Picked from branch stable/2025.2.\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified-1 (copy condition: \"NEVER\")\n* Workflow+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"e0cf89299966fd8b2748f0f71aa741482b068e0a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 14:47:40.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/186b5220f74e4e0a86ae74b2235ca420\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/1e043805e6e248eea4047ec21be82120 : SUCCESS in 13m 52s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a9eaeef9f5b54305a407f6d570714d66 : SUCCESS in 9m 22s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/e25eeb4104b341d3b48b813c717824aa : SUCCESS in 9m 45s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/d4fa0b3ccf9c471982e2c252ed81e8ef : SUCCESS in 9m 27s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/43c45f64629143cfb4e8200a35f2f0bf : SUCCESS in 16m 38s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/50b01a5c93dd4f82b260a5eac6148fcd : SUCCESS in 17m 11s\n- ironic-tox-unit-mysql-migrations https://zuul.opendev.org/t/openstack/build/4d9b81f4adfe49f1b24ba77b9ea30873 : SUCCESS in 7m 00s\n- ironic-tox-unit-with-driver-libs https://zuul.opendev.org/t/openstack/build/5c618baaacb2482a9faef95301fea553 : SUCCESS in 5m 12s\n- ironic-cross-sushy https://zuul.opendev.org/t/openstack/build/39ad4dd33cee4c65b4d568e991cffad2 : SUCCESS in 10m 41s (non-voting)\n- ironic-tempest-functional-python3 https://zuul.opendev.org/t/openstack/build/853170e3dd654153a0d08cee59a215db : SUCCESS in 40m 20s\n- ironic-standalone-redfish https://zuul.opendev.org/t/openstack/build/f4bc244b59a245b1b8b43ab6505d83ed : SUCCESS in 1h 36m 42s (non-voting)\n- ironic-tempest-bios-redfish-pxe https://zuul.opendev.org/t/openstack/build/9a250518d6b9476c8708366c32aff3cd : SUCCESS in 20m 16s\n- ironic-tempest-uefi-redfish-vmedia https://zuul.opendev.org/t/openstack/build/d89dd9f67d0846eba287035e933eb0e9 : SUCCESS in 46m 35s\n- ironic-tempest-ramdisk-bios-snmp-pxe https://zuul.opendev.org/t/openstack/build/c8e201f1a6f24c718d8cc2f80455aea8 : SUCCESS in 16m 25s\n- ironic-tempest-uefi-redfish-https https://zuul.opendev.org/t/openstack/build/2dc266a9196a4a62aa479d215ad98180 : SUCCESS in 50m 00s\n- ironic-tempest-ovn-uefi-ipmi-pxe https://zuul.opendev.org/t/openstack/build/570b5a68860f429a81211228739b01e8 : SUCCESS in 47m 43s\n- ironic-tempest-ovn-uefi-ipxe-ipv6 https://zuul.opendev.org/t/openstack/build/47cdc95e97a24f218c93715c122521a0 : SUCCESS in 30m 41s\n- ironic-tempest-ipa-wholedisk-direct-tinyipa-multinode https://zuul.opendev.org/t/openstack/build/094d2565f08a406cad88c876319ed81c : SUCCESS in 1h 22m 19s (non-voting)\n- ironic-tempest-ipa-wholedisk-direct-tinyipa-multinode-shard https://zuul.opendev.org/t/openstack/build/85154435fee24a28b2ba5bcc79819289 : SUCCESS in 54m 20s (non-voting)\n- ironic-tempest-bios-ipmi-direct-tinyipa https://zuul.opendev.org/t/openstack/build/91daf4ceb8f3489da045bb57ed4029e6 : SUCCESS in 1h 07m 06s\n- ironic-tempest-bfv https://zuul.opendev.org/t/openstack/build/556314b161dc403aacfa549f01adf152 : SUCCESS in 45m 54s\n- ironic-tempest-ipa-partition-uefi-pxe-grub2 https://zuul.opendev.org/t/openstack/build/4bfff142919246cba47c736557f23cb4 : SUCCESS in 46m 11s\n- ironic-tempest-uefi-redfish-vmedia-4k https://zuul.opendev.org/t/openstack/build/a557b93926fc40dd8a4543631e591aaf : SUCCESS in 1h 19m 39s\n- metalsmith-integration-glance-centos9-uefi https://zuul.opendev.org/t/openstack/build/d6f1f1e3524543f8a69420a3f9a998b0 : SUCCESS in 1h 19m 54s (non-voting)\n- ironic-grenade https://zuul.opendev.org/t/openstack/build/26ac94a61d264cea9d17d1ae9eb2ce65 : SUCCESS in 1h 12m 58s\n- ironic-grenade-skip-level https://zuul.opendev.org/t/openstack/build/75cf693c32624ae689f15d641883b58e : FAILURE in 50m 23s (non-voting)\n- ironic-inspector-tempest https://zuul.opendev.org/t/openstack/build/1980122efc7d45d5bf2bcdc68e1167ad : SUCCESS in 48m 36s (non-voting)\n- ironic-inspector-tempest-uefi-redfish-vmedia https://zuul.opendev.org/t/openstack/build/b8ea6c0b213d4db081b9dfee5329bab1 : SUCCESS in 1h 25m 10s (non-voting)\n- ironic-standalone-aarch64 https://zuul.opendev.org/t/openstack/build/a62fe3e48c5a4dedb2fb4d6186623aaf : FAILURE in 31m 16s (non-voting)\n- ironic-tempest-ipa-wholedisk-bios-ipmi-direct-dib https://zuul.opendev.org/t/openstack/build/f04214143b6846dc9863ba9cc0c1cf45 : SUCCESS in 37m 24s (non-voting)\n- ironic-standalone-anaconda https://zuul.opendev.org/t/openstack/build/0cbb0d7042434713a0fe26b9c37db5c7 : SUCCESS in 52m 00s (non-voting)\n- bifrost-integration-tinyipa-ubuntu-noble https://zuul.opendev.org/t/openstack/build/010ddbac2b8d4d55ab0b01c6c888f51a : SUCCESS in 44m 13s (non-voting)\n- bifrost-integration-redfish-vmedia-uefi-centos-9 https://zuul.opendev.org/t/openstack/build/9f0f69640ce44d79a51ce7d7e3607692 : SUCCESS in 52m 40s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"909873873ebc7edceca6133f991f937876919224","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-05-08 14:55:34.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"56ac13a4ee9f5e2b9bc59648909e72522add63ca","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 14:56:11.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"15ac2e21c0e02756deba2f4b291fa9bf0ae8f1c0","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 16:09:17.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3c538cff3a194f7f8865fac20cc00bd2\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/56837d62bf6747a79ad011d332fbdafd : SUCCESS in 8m 23s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/c7672a5f1e5e4918b2d898122024ca2d : SUCCESS in 7m 30s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/c1fe0bd6b0924c2c9325b10ffa21843d : SUCCESS in 8m 03s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d3ae8e7961584741be76a65c806e7f0c : SUCCESS in 11m 56s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/73f154568e184aeea401e01336a8d5c1 : SUCCESS in 12m 40s\n- ironic-tox-unit-mysql-migrations https://zuul.opendev.org/t/openstack/build/e132ef4359aa4de5bfef989c49ecc83e : SUCCESS in 5m 14s\n- ironic-tox-unit-with-driver-libs https://zuul.opendev.org/t/openstack/build/ab5c39a6920d475e838488b7a5a9a683 : SUCCESS in 9m 29s\n- ironic-tempest-functional-python3 https://zuul.opendev.org/t/openstack/build/e1e207152d614ae49e2fed462be67dc3 : SUCCESS in 22m 15s\n- ironic-grenade https://zuul.opendev.org/t/openstack/build/b62b26567d194f01af2c49989c042e36 : SUCCESS in 51m 10s\n- ironic-tempest-bios-redfish-pxe https://zuul.opendev.org/t/openstack/build/47abece110ee47cfb735acdbb632c716 : SUCCESS in 44m 16s\n- ironic-tempest-uefi-redfish-vmedia https://zuul.opendev.org/t/openstack/build/dcf9ef6404cf4cb09f868e18d7c01eef : SUCCESS in 43m 03s\n- ironic-tempest-ramdisk-bios-snmp-pxe https://zuul.opendev.org/t/openstack/build/dea08d1d12cc40469e2c1bf3c023a8cb : SUCCESS in 1h 09m 32s\n- ironic-tempest-uefi-redfish-https https://zuul.opendev.org/t/openstack/build/fc6fcec92cad43aca1e9f57dc898793b : SUCCESS in 28m 02s\n- ironic-tempest-ovn-uefi-ipmi-pxe https://zuul.opendev.org/t/openstack/build/ee74fe3475fe40a383b5dda90cda2b92 : SUCCESS in 45m 36s\n- ironic-tempest-ovn-uefi-ipxe-ipv6 https://zuul.opendev.org/t/openstack/build/04ce3b4d3f8d45dfac336b949aaa6fc5 : SUCCESS in 51m 19s\n- ironic-tempest-bios-ipmi-direct-tinyipa https://zuul.opendev.org/t/openstack/build/453e1f5f87c14ac5be7cb60a0c6dafe8 : SUCCESS in 55m 43s\n- ironic-tempest-bfv https://zuul.opendev.org/t/openstack/build/ceca3260976d490e8c8146754dcf70f2 : SUCCESS in 42m 13s\n- ironic-tempest-ipa-partition-uefi-pxe-grub2 https://zuul.opendev.org/t/openstack/build/5a41d1a85292437d95505c8f060bacf3 : SUCCESS in 47m 29s\n- ironic-tempest-uefi-redfish-vmedia-4k https://zuul.opendev.org/t/openstack/build/1c9fb1d653014b3c95d3369c63f8c19e : SUCCESS in 1h 08m 08s","accounts_in_message":[],"_revision_number":2},{"id":"66848b0e1151242fd190aa8cdd58a934f040243e","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 16:09:17.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"fb12c94b9cf6343069be093918abdf508c1d0b29","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 16:10:46.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d6a09fc7e86b4809afd7208678fdc3f3\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a094149befb44908a9aa6d0c036ffe22 : SUCCESS in 1m 14s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/092208f0705f4f76b37399c7f3eb2302 : SUCCESS in 1m 00s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"8e54f49f9cdbf4794ae8497ab5c3468c000e415c","revisions":{"227b481428718d49af5c7e9bad4d08b8ef5f54ec":{"kind":"REWORK","_number":1,"created":"2026-05-07 23:48:47.000000000","uploader":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"ref":"refs/changes/76/987776/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ironic","ref":"refs/changes/76/987776/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ironic refs/changes/76/987776/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ironic refs/changes/76/987776/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ironic refs/changes/76/987776/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ironic refs/changes/76/987776/1"}}},"commit":{"parents":[{"commit":"27f58a0b29a4dabd42fbca1f8ccbe03094596643","subject":"security: validate molds url against swift in keystone catalog","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic/commit/27f58a0b29a4dabd42fbca1f8ccbe03094596643"}]}],"author":{"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","date":"2026-04-28 18:11:22.000000000","tz":-420},"committer":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2026-05-07 23:48:47.000000000","tz":0},"subject":"security: Use sandbox rendering for jinja2","message":"security: Use sandbox rendering for jinja2\n\nAnalysis revealed that a malicious attacker with sufficent\naccess to request a node to be provisioned could supply a\nmaliciously crafted kickstart template configuration,\nwhich would then be rendered in an unsafe form ultimately.\n\nThis is because the underlying render utility was modeled\nfor rendering only admin-suppied files or the in-code tree\nfiles. Anaconda had to take this further by allowing the\njinja utilized to be user supplied.\n\nAnyhow, an attacker with sufficient access, an ironic deployment\nwith the anaconda deploy interface, a node with the anaconda\ndeployment interface set by an admin, and a malicious template\ncould result in conductor internal data being rendered and if\nthe infrastucture operator is allowing traffic egress for the\nprovisioning network, could have sensitive internal data\nexfiled out of the environment.\n\nThe render helper has been changed to utilize a sandboxed\nenvironment. Attacks such as this now internally raise\na Jinja2 SecurityError.\n\nCloses-Bug: 2148307\nChange-Id: Ie85357166fafca0acd9d852fe05ce34818d2b366\nSigned-off-by: Julia Kreger \u003cjuliaashleykreger@gmail.com\u003e\n(cherry picked from commit a1f9a1e83a3f27d9cb5c796764ddb07ad8cb2616)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic/commit/227b481428718d49af5c7e9bad4d08b8ef5f54ec"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic/commit/227b481428718d49af5c7e9bad4d08b8ef5f54ec"}]},"branch":"refs/heads/stable/2025.1","conflicts":{"ours":"27f58a0b29a4dabd42fbca1f8ccbe03094596643","theirs":"73cbb4eb448ebe2746200eb9e1e08d7ec305c197","contains_conflicts":false}},"8e54f49f9cdbf4794ae8497ab5c3468c000e415c":{"kind":"REWORK","_number":2,"created":"2026-05-08 13:04:09.000000000","uploader":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"ref":"refs/changes/76/987776/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ironic","ref":"refs/changes/76/987776/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ironic refs/changes/76/987776/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ironic refs/changes/76/987776/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ironic refs/changes/76/987776/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ironic refs/changes/76/987776/2"}}},"commit":{"parents":[{"commit":"27f58a0b29a4dabd42fbca1f8ccbe03094596643","subject":"security: validate molds url against swift in keystone catalog","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic/commit/27f58a0b29a4dabd42fbca1f8ccbe03094596643"}]}],"author":{"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","date":"2026-04-28 18:11:22.000000000","tz":-420},"committer":{"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","date":"2026-05-08 13:04:09.000000000","tz":0},"subject":"security: Use sandbox rendering for jinja2","message":"security: Use sandbox rendering for jinja2\n\nAnalysis revealed that a malicious attacker with sufficent\naccess to request a node to be provisioned could supply a\nmaliciously crafted kickstart template configuration,\nwhich would then be rendered in an unsafe form ultimately.\n\nThis is because the underlying render utility was modeled\nfor rendering only admin-suppied files or the in-code tree\nfiles. Anaconda had to take this further by allowing the\njinja utilized to be user supplied.\n\nAnyhow, an attacker with sufficient access, an ironic deployment\nwith the anaconda deploy interface, a node with the anaconda\ndeployment interface set by an admin, and a malicious template\ncould result in conductor internal data being rendered and if\nthe infrastucture operator is allowing traffic egress for the\nprovisioning network, could have sensitive internal data\nexfiled out of the environment.\n\nThe render helper has been changed to utilize a sandboxed\nenvironment. Attacks such as this now internally raise\na Jinja2 SecurityError.\n\nCloses-Bug: 2148307\nChange-Id: Ie85357166fafca0acd9d852fe05ce34818d2b366\nSigned-off-by: Julia Kreger \u003cjuliaashleykreger@gmail.com\u003e\n(cherry picked from commit a1f9a1e83a3f27d9cb5c796764ddb07ad8cb2616)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic/commit/8e54f49f9cdbf4794ae8497ab5c3468c000e415c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic/commit/8e54f49f9cdbf4794ae8497ab5c3468c000e415c"}]},"branch":"refs/heads/stable/2025.1","conflicts":{"ours":"27f58a0b29a4dabd42fbca1f8ccbe03094596643","theirs":"808bc7a74cc689cf307104a02f43b9fab1654c40","contains_conflicts":false}}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"}},{"label":"Backport-Candidate","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Backport-Candidate","description":"Backport candidate status","status":"NOT_APPLICABLE","is_legacy":false,"applicability_expression_result":{"fulfilled":false,"status":"FAIL"},"submittability_expression_result":{"expression":"is:true","fulfilled":true,"status":"NOT_EVALUATED","passing_atoms":[],"failing_atoms":[],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}